John Compton john_compton24 (at) yahoo (dot) com [email concealed] wrote:
>Another possibility for remote code execution would be to trigger a
>context-switch mid-memcpy which would halt the memory copy operation
>before it hits an unpaged address. This, if possible, might leave the
>heap in a corrupted state but allow another thread to access/traverse
>the heap before the exception occurs. However, Microsoft compilers
>optimize the memcpy() function call to the REPNE MOVSD instruction. This
>makes it extremely unlikely, if not statistically impossible, to
>get a context switch at the right time before an unpaged address is
>accessed. Once again, this cannot be used to exploit this bug.

REP string instructions (eg. REP MOVS), like all other instructions, all
check for HW interrupts after each iteration is complete. It is not possible
to load ECX with FFFFFFFFh and do a REP LODSD to stop HW interrupts from
occuring until ECX is 0.

_________________________________________________________________
Plan your next US getaway to one of the super destinations here.
http://special.msn.com/local/hotdestinations.armx

[ reply ]